Instructor: Golden ticket. 2 2
Now, in the last lesson 3 3
we talked about the pass the hash attack. 4 4
Now a pass the hash attack will work on local workstations 5 5
but if you're going to be using something 6 6
on a domain environment 7 7
you're really going to need to attack a Kerberos ticket 8 8
because this is what's used 9 9
in an active directory environment. 10 10
The pass the hash attack can work on multiple workstations 11 11
across the domain if those systems 12 12
have all been logged into by the same user. 13 13
But if they haven't 14 14
then you're going to need to work on a golden ticket instead. 15 15
Now, what is a golden ticket? 16 16
Well, if you've ever read the book 17 17
"Charlie and the Chocolate Factory" or seen the movie 18 18
you've probably heard of a golden ticket. 19 19
Essentially, this was the winning ticket 20 20
that got you unlocked privileges 21 21
to anything you wanted inside their factory. 22 22
It was a universal skeleton key essentially, 23 23
and essentially in our networks 24 24
that's what a golden ticket is. 25 25
When I talk about a golden ticket, 26 26
a golden ticket is a Kerberos ticket 27 27
that can grant other tickets 28 28
in an active directory environment. 29 29
And so it can create keys that allow you to get access 30 30
to anything you want. 31 31
Golden tickets can grant administrative access 32 32
to other domain members and domain controllers 33 33
within the network, and so they are really, really powerful. 34 34
Before we talk about exactly 35 35
how a golden ticket attack works 36 36
I think it's important for us to revisit a key concept 37 37
about how Kerberos works. 38 38
Now, this is going to be a very quick review 39 39
because this is something you should have already learned 40 40
back in Security Plus 41 41
but I want to provide a quick refresher 42 42
so you can better understand how this attack works. 43 43
First, we have something known as a krbtgt hash, 44 44
which is essentially a Kerberos ticket-granting 45 45
ticket hash is what it stands for. 46 46
Now this is the trust anchor of active directory domains 47 47
and these function like a private key 48 48
of a root certificate authority, 49 49
and they're used to generate ticket-granting tickets 50 50
that are used by users across the network 51 51
to access services within Kerberos. 52 52
Now, under Kerberos, a client is generally going to be a user 53 53
or a service, and they're going to send a request 54 54
for a ticket to the KDC, the key distribution center. 55 55
The KDC will then create this ticket-granting ticket 56 56
or TGT for the client. 57 57
It's going to encrypt it using the client's password 58 58
as the key and then send the encrypted ticket 59 59
back to the client. 60 60
The client will then attempt to decrypt the TGT 61 61
or the ticket-granting ticket using the client's password. 62 62
If the client successfully is able to decrypt 63 63
the ticket-granting ticket 64 64
this means the client gave the right password 65 65
and the ticket-granting ticket will be decrypted 66 66
which indicates proof of the client's identity. 67 67
Now, the ticket-granting ticket will expire 68 68
after a certain time, and this will allow the user 69 69
to be able to obtain additional tickets 70 70
whenever they need them 71 71
and get permission for specific services. 72 72
The requesting and granting of these additional tickets 73 73
is considered user transparent 74 74
and happens all the way in the background 75 75
in these Windows environments. 76 76
Now, as I said, the Kerberos ticket grading ticket hash 77 77
is the trust anchor to this whole thing on the server 78 78
as it is generating the ticket-granting tickets. 79 79
So if an attacker could compromise that 80 80
this whole system could be used to create their own tickets 81 81
and gain authorization to anything they want. 82 82
And that's exactly how a golden ticket attack works. 83 83
They go after this Kerberos ticket-granting ticket hash. 84 84
So let's see how that works. 85 85
First, how does a golden ticket attack work? 86 86
The first thing is the attacker 87 87
is going to try to access the NTDS.DIT file. 88 88
This allows the attacker to gain access to this file 89 89
that contains the active directories data store 90 90
and inside of that is 91 91
the Kerberos ticket-granting ticket hash 92 92
and all of the hashes for the administrative accounts. 93 93
Now that the attacker has this NTDS.DITs file 94 94
they can dump it 95 95
and identify the Kerberos ticket-granting ticket hash, 96 96
and those administrative hashes. 97 97
Once they've done that, they can move on to the fun part. 98 98
And as an attacker, this is going to be really good for them 99 99
but really bad for our defenders. 100 100
As defenders, we may identify that a breach has occurred 101 101
and we go forward and make everybody 102 102
with an actor directory account reset their passwords. 103 103
But if we don't reset 104 104
the Kerberos ticket-granting ticket hash 105 105
then the attacker will still have access 106 106
and often responders will forget to do this. 107 107
And this allows attackers to stay in these systems 108 108
for a really long period of time. 109 109
So our attacker who still has a valid 110 110
Kerberos ticket-granting ticket hash 111 111
can use an exploit module to create golden tickets 112 112
for a user in the administrative group. 113 113
Now that they have that golden ticket created 114 114
with the Kerberos ticket-granting ticket hash 115 115
they are now ready to do whatever else 116 116
they want to do on that system 117 117
because the attacker can use that golden ticket 118 118
to assume an administrative identity. 119 119
So they can now do follow on exploitation 120 120
and do whatever they need to do on that system 121 121
or even across the domain 122 122
because those tickets work 123 123
with Kerberos which works across the domain. 124 124
Now, for example, they might go ahead 125 125
and compromise your domain controller. 126 126
They could log in using that golden ticket 127 127
and perform PowerShell or command line actions 128 128
on that server or whatever bad action they want 129 129
using that administrative level control. 130 130
And this is why golden tickets are just so dangerous. 131 131
So when you think about Golden Tickets, 132 132
I want you to remember that golden tickets 133 133
allow attackers to laterally move across 134 134
the entire domain with ease. 135 135
It is basically a skeleton key that can open any door 136 136
they want on your network. 137 137
So it's really important that administrators make sure 138 138
that they reset the Kerberos ticket-granting ticket hash 139 139
account password regularly. 140 140
This will make sure that if you have been compromised 141 141
you can clear out the ability of an attacker 142 142
to create new golden tickets. 143 143
Also, if you need to change 144 144
the Kerberos ticket-granting ticket account password, 145 145
you need to reset that password twice 146 146
in a short period of time to invalidate the golden ticket 147 147
if a breach is suspected. 148 148
Essentially you're going to change the password, 149 149
reboot the computer, change the password again, 150 150
reboot the computer. 151 151
By doing that, you are revoking all of the existing 152 152
golden tickets and making sure the new ones are being issued 153 153
with the new password, and that removes any ability 154 154
of the attacker to use it inside your system anymore. 155 155
Now, as we finish up this lesson 156 156
I want to leave you with one quick warning. 157 157
As you're reading up on a Golden Ticket attack 158 158
as an analyst in the field, 159 159
you may come across some older articles 160 160
that talk about this technique. 161 161
In those articles, they may mention 162 162
that you should be looking 163 163
for a domain name field being left blank 164 164
as an indicator of compromise. 165 165
And that is true for older golden ticket programs 166 166
because they didn't include a domain name field 167 167
when they made those golden tickets. 168 168
And that way it made it very easy 169 169
for us to detect them in the logs. 170 170
But most of the newer golden ticket programs have fixed this 171 171
and they actually include a domain name now. 172 172
So this isn't the easy IOC that it used to be 173 173
but it is still one that you should look for. 174 174
Remember, all your log on and log off events 175 175
are recorded in your Windows event log. 176 176
And so you can actually look at them 177 177
with the username and the domain name 178 178
of the account that's logging in and out. 179 179
And if you see one that doesn't have a domain name 180 180
that could be an indication 181 181
that somebody's using an older golden ticket program 182 182
and they are using a golden ticket attack against you.